Search I’ve been hacked Advice Menu
I’ve been hacked
For me Overview: For me
For businesses Overview: For businesses
Costs and comparison Overview: Costs and comparison
Swiss threat landscape Overview: Swiss threat landscape

IT service provider and software company: what can happen, and who pays?

limited 5 of 10 cost items usually covered

5 typical cases with a receipt: what they cost and which item cyber insurance usually pays. According to our research, pay particular attention to “Fake helpdesk via Teams” (likelihood high).

As of

IT service provider1. Fake helpdesk via Teams14. Own faulty update paralyses customers43. Own systems encrypted, customer data published32. All customers encrypted via remote maintenance25. App sends text messages at the provider’s expense5

Fake helpdesk via Teams

Own faulty update paralyses customers

Own systems encrypted, customer data published

All customers encrypted via remote maintenance

App sends text messages at the provider’s expense

Tap a number to jump to the scenario.

On this page
  1. Scenarios
  2. A day closed
  3. Connected
  4. Real cases

5 scenarios, 5 receipts

  1. Fake helpdesk via Teams
  2. All customers encrypted via remote maintenance
  3. Own systems encrypted, customer data published
  4. Own faulty update paralyses customers
  5. App sends text messages at the provider’s expense

1Fake helpdesk via Teams

Receipt

IT service provider and software company

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 2'500–16'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 10–40 h × CHF 250–400/h (market range for incident response)

  • IT service provider: clean-up, rebuild, restoring the backup CHF 3'600–13'500 covered

    Restoration of data, software and systems in the basic cover; Sunrise/AXA collective only up to CHF 20'000 first-party loss. How we got there: 20–60 h × CHF 180–225/h (IT support for SMEs, office hours)

Usually paid by the cyber policy
CHF 6'100–29'500
Open or only with an add-on
nothing
Usually stays with the business
nothing

Likelihood high

After email bombing, a «helpdesk» gets in touch via Teams and has a remote maintenance program installed; ransomware follows.

How it unfolds

Entry point: Social engineering via Teams and telephone

What AI changes: A voice can be cloned with just a few seconds of audio from videos, voice messages or voicemail. In the canton of Schwyz in 2026, an owner made transfers of several million francs after calls with an AI voice.

Why high? NCSC 2024 (Black Basta); CrowdStrike: vishing +442%.

What prevents it

  • Block external Teams contacts.
  • Verify the helpdesk’s identity with a call-back.
  • Remote maintenance only with approved tools.
Pitfalls in the terms
  • Backup obligation: AXA and Mobiliar require a backup disconnected from the network at least weekly, Zurich every 7 days, Helvetia daily with a functional check. If it is missing, the insurer reduces the benefit; at AXA, without a usable backup, only the costs of establishing the loss are paid.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. C3 und C5, S. 14

    «keine verwendbare Datensicherung vorhanden ist, so sind nur die Kosten zur Feststellung dieses Sachverhalts gedeckt»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Immediate help in an emergency, Restore data and systems

2All customers encrypted via remote maintenance

Receipt

IT service provider and software company

Tap a line for the reasoning

  • IT forensics and incident response (analysis, containment, preservation of evidence) CHF 12'500–80'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 50–200 h × CHF 250–400/h (market range for incident response)

  • Claims by customers CHF 50'000–1'000'000 unclear

    Cyber liability covers the transmission of malware (Zurich); claims arising from defective services belong in professional liability (distinction in each individual case). How we got there: Assumption; Unico Data: loss «well over 1 million francs» (own loss).

  • Lawyer: reporting obligations under the FADP, notification of affected persons, defence against claims CHF 5'000–28'000 covered

    In the basic cover at AXA, Mobiliar, Zurich, Helvetia and Chubb; AXA immediate measures up to CHF 5'000 without deductible. How we got there: 20–80 h × CHF 250–350/h (lawyer’s rate in Switzerland)

Usually paid by the cyber policy
CHF 17'500–108'000
Open or only with an add-on
CHF 50'000–1'000'000
Usually stays with the business
nothing

Likelihood medium

Attackers misuse the service provider’s remote maintenance software and distribute ransomware to dozens of customers at the same time. Customers claim damages for their outages.

How it unfolds

Entry point: Compromised remote maintenance (supply chain)

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Kaseya 2021 (Coop Sweden); several service provider cases in Switzerland (Unico Data, Xplain).

What prevents it

  • Remote maintenance with two-factor login and approval per customer.
  • Coordinate professional liability and cyber liability.
  • Emergency plan for a mass incident.
Pitfalls in the terms

Modules: Immediate help in an emergency, Third-party claims after a data breach

3Own systems encrypted, customer data published

Receipt

IT service provider and software company

Tap a line for the reasoning

  • Total loss (comparable case) CHF 1'000'000 limited

    Exceeds typical SME sums insured. How we got there: Unico Data: «well over 1 million francs» (NCSC).

  • Notification of affected persons by letter (postage only) CHF 1'000–24'000 covered

    Notification of affected persons in the basic cover; usually the insurer’s prior consent is required. How we got there: 1'000–20'000 letters × CHF 1.00–1.20 (B-/A-Post 2026); printing, envelope and address preparation not found, would come on top

Usually paid by the cyber policy
CHF 1'000–24'000
Open or only with an add-on
CHF 1'000'000
Usually stays with the business
nothing

Likelihood medium

The Play group encrypts the systems of an IT provider for SMEs; most services are offline. Without a ransom, the perpetrators publish data on the dark web.

How it unfolds

Entry point: Ransomware

What AI changes: AI speeds up finding open vulnerabilities (router, VPN, remote maintenance) and writing extortion emails; the time between publication of a vulnerability and an attack is getting shorter, and the insurers’ patch deadline (14 or 30 days) becomes tight.

Why medium? Unico Data 2023 (loss well over CHF 1 million), Xplain 2023.

What prevents it

  • Keep customer data separate.
  • Offline backup.
  • Practise with a crisis team.
Pitfalls in the terms
  • Reporting obligation: a data security breach likely to result in a high risk must be reported to the FDPIC as soon as possible (Art. 24 FADP). Agree notification and PR with the insurer in advance (AXA, Helvetia), otherwise there will be disputes about the costs.
    Where does it say so?

    Bundesgesetz über den Datenschutz (DSG), SR 235.1, geltende Fassung, Art. 24 DSG (Paraphrase)

    Open document: Bundesgesetz über den Datenschutz (DSG), SR 235.1 (opens in a new window), retrieved 06.11.2026

  • Ransom: Mobiliar and Sunrise never pay, AXA only with the «Cybererpressung» extension, Zurich within the sub-limit of 25% of the first-party sum insured, Helvetia CHF 30'000–100'000; reporting to the police is mandatory.
    Where does it say so?

    Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB), Ausgabe 01/2024, Art. 10.1, S. 7

    «Bei sämtlichen Ransomware-Attacken muss eine Strafanzeige bei der Polizei eingereicht werden.»

    Open document: Zurich Cyberversicherung, Kundeninformation und Allgemeine Versicherungsbedingungen (AVB) (opens in a new window), retrieved 06.11.2026

Modules: Restore data and systems, Inform affected people

4Own faulty update paralyses customers

Receipt

IT service provider and software company

Tap a line for the reasoning

  • Claims by customers no reliable figure not covered

    Not a cyber event; professional liability. How we got there: Cannot be quantified.

  • Own additional effort no reliable figure add-on

    AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover operating errors. How we got there: Cannot be quantified.

Usually paid by the cyber policy
nothing
Open or only with an add-on
1 item without an amount
Usually stays with the business
1 item without an amount

Likelihood medium

A faulty update, without any attack, paralyses the systems of 40 customers for a day.

How it unfolds

Entry point: Operating error, not an attack

What AI changes: AI-generated code without review increases the risk (assumption).

Why medium? Typical operational risk (assumption).

What prevents it

  • Staggered rollout.
  • Rollback plan.
  • Professional liability.
Pitfalls in the terms
  • Operating errors without an attack: AXA insures only intentional attacks; Mobiliar (BI only with add-on), Zurich (Optimum/Premium) and Helvetia (exhaustive list) cover negligent errors by staff.
    Where does it say so?

    Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung, Ausgabe 06.2024 (16381DE – 2024-06), Ziff. E2, S. 16

    «Ein Cyber-Eigenschaden-Ereignis ist ein vorsätzlicher, schädigender Angriff durch Dritte oder durch versicherte Personen»

    Open document: Allgemeine Vertragsbedingungen (AVB) KMU Versicherung, Modul Cyberversicherung (opens in a new window), retrieved 06.11.2026

Modules: Third-party claims after a data breach, Outage due to operating error

5App sends text messages at the provider’s expense

Receipt

IT service provider and software company

Tap a line for the reasoning

  • SMS charges no reliable figure unclear

    Helvetia covers misuse of the telephone system and computing capacity; SMS pumping in apps is not expressly governed. How we got there: Amount not stated.

Usually paid by the cyber policy
nothing
Open or only with an add-on
1 item without an amount
Usually stays with the business
nothing

Likelihood medium

Attackers register hundreds of thousands of times with an app; each registration triggers an expensive text message, part of whose charges flow to the perpetrators.

How it unfolds

Entry point: Misuse of SMS verification

What AI changes: Automation, hardly any AI needed.

Why medium? Described by the NCSC in 2022.

What prevents it

  • SMS limits per country.
  • Captcha and rate limiting.
  • Cost alert with the SMS provider.
Pitfalls in the terms

Modules: Phone hacking and extra costs

Ranges for a small to medium-sized business, not an insurance benefit. Deductible, sums insured and sublimits come on top. The bars on all receipts use the same scale.

Overview based on public policy terms, as of 06.11.2026. Only your policy and its general terms and conditions (GTC) are binding. No confirmation of cover.

What a day of downtime costs

CHF 12'340 Average revenue per day; your business may be smaller.

Where the figures come from

Average of businesses liable for VAT (SFTA 2024); small businesses are lower. Only the loss of income after the waiting period is insured (revenue minus saved costs or EBITDA). Reliability: medium.

Waiting period: loss of income only after 12 hours (AXA; Mobiliar only with add-on B4) or 24 hours (Helvetia); at Zurich only in Optimum/Premium, waiting period according to the policy. An outage shorter than the waiting period is borne by the business.

What is connected in the business

Real cases

  • Switzerland · 10.2024

    Company (anonymous)

    First, a victim’s mailbox was flooded with 50 to 100 spam emails per minute.

  • Switzerland · 05.2023

    Unico Data AG

    In May 2023, the group «Play» attacked the provider of IT solutions for SMEs; most services were then offline.

  • Switzerland · 05.2023

    Xplain AG

    In May 2023, the group «Play» attacked the IT service provider Xplain and published captured data on the darknet.

3 more cases and sample cases

  • Switzerland · 12.2022

    App provider (anonymous)

    Attackers automatically registered several hundred thousand times with an app using foreign telephone numbers.

  • Sweden · 07.2021Abroad: Sweden

    Coop Sverige (not Coop Switzerland)

    At the beginning of July 2021, REvil distributed ransomware via a fake update of the remote maintenance software Kaseya VSA.

  • Real case, published by the insurer: Helvetia

    sydoc (document processing, Baar ZG), March 2021: after an attack, there is no longer any access to the data, and hackers demand a six-figure sum; InfoGuard solves the problem. The cyber policy had been taken out six months earlier; according to the owner, the company’s survival would have been at risk without it.

    Promotional customer story. Page not read directly because of a certificate error, information only from search results (German and Italian versions). Whether ransom was paid and what amounts Helvetia paid: not stated.

    Where does it say so?

    sydoc (Kundengeschichte im Helvetia-Magazin «viva»), Vorfall März 2021; Publikationsdatum nicht geprüft, Kundengeschichte

    «sydoc habe keinen Zugriff mehr auf ihre Daten und Hacker forderten eine sechsstellige Summe Lösegeld.»

    Open document: sydoc (Kundengeschichte im Helvetia-Magazin «viva») (opens in a new window), retrieved 06.11.2026

Three ways forward